REMARKS 

Claims 1-3, 5-19, 21-27, and 54-59 were presented for examination and were rejected in 
the final Office Action mailed May 18, 2007. Applicants are hereby amending claims 1-3, 5, 8, 
10, 12, 13, 17-19, 23, 25, 54-56, 58, and 59. Support for all amendments is found in the 
application as originally filed. Reconsideration of the application as amended, and allowance of 
all claims herein, claims 1-3, 5-19, 21-27, and 54-59 as amended, are hereby respectfully 
requested. 

In the second paragraph of her final Office Action, the Examiner rejected claims 1, 2, 5- 
19, 21-27, and 54-59 under 35 U.S.C. 102(e) as being anticipated by Lachman U.S. patent 
publication no. 2002/0166063, filed February 28, 2002 (hereinafter " Lachman II "). Lachman II 
claims priority to Lachman U.S. provisional patent application serial no. 60/272,712, filed March 
1, 2001 (hereinafter " Lachman I "). The filing date of the instant application is October 19, 2001, 
which falls between the filing dates of Lachman I and Lachman II . Therefore, any new matter in 
Lachman II cannot be used as prior art against the claims of the instant application. In her 
Advisory Action mailed August 22, 2007, the Examiner indicated the sections of Lachman I that 
she considers pertinent to the present claims. 

Claim 1 as amended is patentably distinct over Lachman L because: 

1 . Claim 1 recites that the content match is applied to information within the content 
portions of the data packets. Lachman I discloses that "packets are compared to a stored 
signature database" in the packet sniffing portion of his method (page 5 line 4), but is vague as to 
the definition of "signature". In all of the examples in Lachman I that are relevant to the 
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locations within the packets where the comparisons are performed, Lachman I discloses that the 
comparisons are performed in the header portions of the packets, as opposed to the content 
portions. Lachman L page 6 line 20, page 10 lines 20-22, page 1 1 line 5, page 12 line 4, page 13 
line 16, page 13 line 21, page 14 line 3, page 14 line 19, and page 16 lines 22-23. This is not 
surprising, given that the purpose of Lachman I is to thwart denial of service attacks ( Lachman L 
page 4 line 5). Thus, apparently, Lachman I operates exclusively at the network layer of the OSI 
network model, whereas the present invention is able to analyze packets at any level of the OSI 
model, and is able to perform this analysis for any and all protocols. Figures 2a and 2b, and 
accompanying description, of the present application. 

2. Claim 1 recites that when information within the content portion of a data packet 
is substantially similar to content match information, the DED initiates issuance of a message to 
a user workstation and invokes the RTP to process a transaction. Lachman I, on the other hand, 
does not disclose user workstations nor does it disclose anything analogous to Applicants' RTP. 
This recitation in claim 1 implies a built-in time delay to accommodate a response from the user. 
In Lachman I, on the other hand, the second step, verification of a denial of service attack, is 
performed by the Decision Module, which analyzes the data in real time, with no time delay. 
Lachman L page 5 line 10, page 6 line 2. 

Claims 2, 5-17, and 54-59 depend from claim 1, and thus their patentability flows from 
the patentability of claim 1 . Furthermore, these dependent claims include additional features that 
distinguish them from the prior art. 

-9- 

272801 10W- 1 



For example, with respect to amended claim 2, Lachman I does not disclose or suggest 
control information associated with the content match information. 

With respect to amended claim 5, Lachman I does not disclose or suggest anything 
analogous to an RTP comprising a network server and a database, said RTP operable to process 
requests for content. 

With respect to amended claim 54, Lachman I does not show or suggest anything 
analogous to a DED operable to search data packets for content match information to determine 
whether transmission of data packets associated with particular content should be prevented, and 
when the DED finds such content match information, the DED prevents further transmission of 
these data packets without additional processing. Lachman I does not prevent further 
transmission of any packets (said prevention is referred to in Lachman I as a "countermeasure") 
until Lachman I determines, in a second step, whether the packet sniffing assessment of a 
possible threat (performed in his first step) is accurate. Lachman I, page 5 lines 20-22, page 10 
lines 1-8, page 1 1 line 21 through page 12 line 6, and page 15 lines 13-20. Such a second step is 
expressly disclaimed in Applicants' claim 54. Lachman Fs Decision Module, in his second step, 
requires analysis of incoming packets and router loads to assess the threat. Lachman I, page 7 
lines 4-8; page 1 1 line 20 through page 12 line 6. Nothing in Lachman I teaches or suggests that 
the packets are prevented from further transmission during the threat assessment (first step) as in 
claim 54. 
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Claim 18 as amended contains substantially the same limitations that are recited in 
amended claim 1 . Therefore, the arguments submitted above in favor of the patentability of 
claim 1 also pertain to the patentability of claim 1 8, mutatis mutandis . 

Claims 19 and 21-27 are dependent claims depending upon claim 18. Therefore, their 
patentability flows from the patentability of claim 18. Furthermore, these dependent claims 
contain additional limitations not suggested by the prior art. 

For the above reasons, Applicants request the Examiner to withdraw her rejection of 
claims 1, 2, 5-19, 21-27, and 54-59; and to allow these claims as amended. 

In the fourth paragraph of her final Office Action, the Examiner rejected claim 3 under 
Lachman II in view of U.S. patent 5,710,757 to May . 

Claim 3 is a dependent claim depending upon claim 1 . As demonstrated above, amended 
claim 1 is patentable. The addition of May to the rejection does nothing to counter the 
patentability of claim 1 . Therefore, it follows that claim 3 is patentable. 

For the above reasons, Applicants request the Examiner to withdraw her rejection of 
claim 3, and to allow claim 3 as amended. 
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Applicants believe that this application is now in condition for allowance of all claims 
herein, claims 1-3, 5-19, 21-27, and 54-59 as amended, and therefore an early Notice of 
Allowance is respectfully requested. If the Examiner disagrees or believes that, for any other 
reason, direct contact with Applicants 5 attorney would help advance the prosecution of this case 
to finality, she is invited to telephone the undersigned at the number given below. 



SONNENSCHEIN NATH & ROSENTHAL LLP 
P.O. Box 061080 

Wacker Drive Station, Sears Tower 
Chicago, IL 60606-1080 
tel.: (4 15) 882-2402 

cc: IP/T docket CH 
G. Sullivan 
M. O'Brien 



date of signature: 




Edward J. Radio 
Attorney Under Rule 34 
Reg. No. 26,793 



27280 110W-1 



-12- 



